black list public ip IKE protocol

[François]

Hi,

I use FG600D (Fortios V5.4.5) with 30 VPN (IKE) but since few weeks i have trouble with some public ip like 216.218.206.126. Each night i have a lot of attempts to establish VPN IKE. This public ip is not public ip of my company.

For example :

Message meets Alert condition

date=2018-06-03 time=04:47:33 devname=FW-BLC-1 devid=FGT6HDXXXXXXX logid=0101037128 type=event subtype=vpn level=error vd=root logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action=negotiate remip=[style="background-color: #ffff00;"]216.218.206.102[/style] locip=xxx.xxx.xxx.xxx remport=24916 locport=500 outintf="IP-Pub-Complete" cookies="3e35c70729dfedef/0000000000000000" user="N/A" group="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status=failure init=remote mode=main dir=inbound stage=1 role=responder result=ERROR

I try to use local in policy but i don't understand how. In my all Fortigate i saw local in policy in GUI but in CLI i have nothing. 

Please could you tell me if it's the good way to block unwanted public ip ? and if it's the good way could you explained me how can i do ?

In Example i found, all people explain to choose wan interface for source but i don't know which destination interface i must select.

Thank you,

François

[Markus]

Hi, There is a similar post here https://forum.fortinet.com/tm.aspx?tree=true&m=160521&mpage=1 that should help. Best, Markus

[François]

Thank you Markus for your reply but i don't understand why i can't see local policy in CLI ?

In example gave by Stuart he explained i use "edit 1" but in my case i don't have any policy. If i do "edit 1" i create a new policy.

At the same time in GUI i have aproximatively 80 or 100 local in policy.

Thank you for help,

[Toshi_Esumi]

I don't think local-in policy is available in GUI. You must be talking about regular firewall/security policies in GUI. If you don't see anything under "configure firewall local-in-policy", you don't have "local-in" policy yet. So edit 1 or edit 0 create a new policy with id:1.

[François]

Hi,

Thank you Toshi,

I create local in policy but is nbot working like i want.

I add 4 rules in local in policy

config firewall local-in-policy

    edit 1

        set ha-mgmt-intf-only disable

        set intf "Orange-Fibre"

        set srcaddr "Block-IP-1"

        set dstaddr "all"

        set action deny

        set service "IKE"

        set schedule "always"

        set status enable

    next

    edit 2

        set ha-mgmt-intf-only disable

        set intf "Orange-Fibre"

        set srcaddr "Block-IP-1"

        set dstaddr "all"

        set action deny

        set service "ESP"

        set schedule "always"

        set status enable

    next

    edit 3

        set ha-mgmt-intf-only disable

        set intf "Orange-Fibre"

--More--                  set srcaddr "all"

        set dstaddr "MyPulbic"

        set action accept

        set service "IKE"

        set schedule "always"

        set status enable

    next

    edit 4

        set ha-mgmt-intf-only disable

        set intf "Orange-Fibre"

        set srcaddr "all"

        set dstaddr "MyPulbic"

        set action accept

        set service "ESP"

        set schedule "always"

        set status enable

    next

end

My idea for test is to block only one public ip of another Fortigate i manage.

Public ip of another fortigate is in srcaddr "Block-IP-1"

When i apply this rules my VPN doesn't stop and continue to work. I try to bring downd and bring up but VPN continue to work.

Perhaps i don't undrstand something ?

Thank you for your help,

François

[Toshi_Esumi]

Is the interface "Orange-Fibre" the IPSec interface or a physical interface? In the thread Markus pointed to had an IPSec interface.

[François]

Hi Toshi,

I added a screenshot to show you. In fact i apply to wan interface and not to IPSEC interface. 

I don't understand why i must apply to IPSEC interface ? if i want to block some bad public ip to mount IPSEC i don't create an interface IPSEC for it.

This morning i modify local in policy and i replace :

set service IKE

by

set service  ALL

In this case the first Fortigate (which i apply local in policy), tunnel continue to bring up but on another side of VPN the second Fortigate show tunnel down. I think it's normal because flow is sending by first fortigate and it use the same chanel for reply (it's just an idea)

In my test configuration i think i must apply local in policy on two fortigate because each one can initialize IPSEC. In case of bad public ip which want to try open IPSEC is different.

I'll keep you informed and if you could confirm different idea ?

François 

[Markus]

Hi François Here's my config. I only enable Swiss IPs to connect (IPSec and SIP) to my Wan Interface (in your case it's the Orange I assume). config firewall local-in-policy     edit 1         set intf "wan1"         set srcaddr "zGeoSwiss"         set dstaddr "all"         set action accept         set service "GRE" "IKE" "SIP"         set schedule "always"     next     edit 2         set intf "wan1"         set srcaddr "all"         set dstaddr "all"         set service "IKE" "GRE" "SIP"         set schedule "always"     next end First you have to enable all sources that are allowed to use the defined Services. Then you block all others (edit 2).

I hope this clarify how the local-in policy works. Best,

Markus

[ede_pfau]

For convenience, you can find configs for all countries, converted to address objects and an address group, on my website.

[François]

Hi guys,

Thank you for all to your answers.

@Toshi: I don't create interface-mode IPSec vpn, i just only want to reject public ip which want to use IKe.

@Bruno: Yes i know shadowserver but it's not really good to receive 50 or 60 emails by night. I prefer reject this public ip and some other to be sure.

@Markus: Good i think it's the similar configuration i have today, but i think you forgot "set action Deny" on Edit 2 isn't it ?

@ede_pfau: It's another good solution but i keep you idea.

Best regards,

François